Soxpeca & Co.

[datanet]

Hello team.

I am in the unfortunate position to have to remove soxpeca and everything that comes with it, because the infected machine is a Windows 2000 domain controller and cannot be "quickly formatted". I have found a post that started promising, but then was closed. Please - could anyone guide me through this?

Thanks.

This is what I have tried so far. I am sure you cann see what it means... I was able to kill al processes, and manually remove the services from the registry, but after a reboot they were all back plus c:\winnt\system32\udxfytw.exe appeared... After I killed all processes I wanted to delete the files, but allthough I am domain admin, windows tells me I am not allowed to delete them. Taking ownership and altering the access rights didn't help... I couldn' identify the process, that reinstalls all of them again...


kill -f 3356
del c:\winnt\system32\soxpeca.exe

del c:\winnt\system32\afisicx.exe

kill -f 1800
del c:\winnt\system32\mabidwe.exe

del c:\winnt\system32\noytcyr.exe

del c:\winnt\system32\roytctm.exe

del c:\winnt\system32\tdydowkc.exe

del c:\winnt\system32\wsldoekd.exe

del c:\winnt\system32\udxfytw.exe


ren c:\winnt\system32\mscfco.exe *.exi

[silver]

the infected machine is a Windows 2000 domain controller

As this is a business computer, I would direct your attention to forum policy:

In General, we do not help in cleaning business or corporate computers. There may be restrictions and modifications installed on such machines that could be damaged or altered by the actions we take to remove Malware. There may also be legal issues regarding any loss of business data that we do not wish to deal with.

This site exists for the purpose of helping home computer users rid their systems of malware, not business users, so I'm sorry we won't be able to help.

[datanet]

Well - not everything is what it seems...
I am running this domain controller for family purposes, as the Server Software was given to me as a present. So therefore - yes! this is purely privat.
(My family is rather big...)
And I really don't want to format this machine... So please - anyone out there to help me?

[silver]

Also to be found on the rules page:

We CANNOT HELP remove malware from any of the Windows Server editions, like Windows 2003.

Again I am sorry but we won't be able to help you. We wish you the best of luck in resolving the issue.

[datanet]

In this case I would like to kindly ask you to close and delete my account at your site.
Thanks